refactor(sandbox): remove container browser-GUI (noVNC), keep vbox VM GUI

The docker/podman headless-container desktop (XFCE + TigerVNC + websockify
+ noVNC published on host 127.0.0.1:6080) is removed. It was unreliable: the
desktop stack installed asynchronously during provisioning with every step
wrapped in `|| true` (silent failures), while the host port mapping existed
the moment the container ran — so opening the browser before websockify bound
6080 inside the container reset the connection (ERR_CONNECTION_RESET), with no
readiness signal and no loud failure. Containers also can't be rendered as a
real desktop by VirtualBox (no framebuffer/display), so the only desktop path
that stays is the native VirtualBox VM GUI.

Removed:
- sbx.rs: GUI_PORT const; PortHolder/port_holder()/kill_port_holder() (the
  port-consent gate existed only for the noVNC publish); the `gui` param +
  `-p 127.0.0.1:6080:6080` block in prepare(); HH_SBX_GUI env in dk_bootstrap();
  the `gui` param on provision().
- app.rs: PendingGuiLaunch + PortPrompt structs; the port_prompt App field; the
  `gui` field on PendingSudoLaunch; the port-consent modal + the sudo-submit
  port check; want_gui/gui parsing + the container-GUI launch message; `gui`
  threaded through spawn_launch and all call sites.
- sandbox-bootstrap.sh: the entire HH_SBX_GUI=1 desktop block.
- ui.rs / usage strings: dropped "[gui]"/"noVNC desktop" from the docker/podman
  help and the /sbx usage line.

Kept (unchanged): the VirtualBox VM GUI — gui_launch() (VBoxManage startvm
--type gui), launch_vbox_gui, `/sbx vbox gui <vm>` and the `/sbx gui` alias. The
`gui` keyword is still stripped from positionals so `/sbx vbox gui <vm>` parses.

cargo check passes clean (no warnings).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hh/scripts/sandbox-bootstrap.sh

@@ -50,63 +50,6 @@ if ! apt-get install -y --no-install-recommends $PKGS; then
     done
 fi
 
-# ---- Optional GUI desktop over noVNC -----------------------------------------
-# Opt-in via HH_SBX_GUI=1 (set by the launcher for `/sbx <docker|podman> gui`).
-# Containers are headless, so a GUI means: install a lightweight XFCE desktop +
-# a VNC server, and bridge it to a browser-reachable noVNC websocket on port
-# $HH_SBX_GUI_PORT (default 6080). The launcher publishes that port on the host
-# loopback (127.0.0.1) only, so the desktop is reachable from this machine's
-# browser but never the LAN. Heavy (pulls a desktop), hence strictly opt-in.
-if [[ "${HH_SBX_GUI:-0}" == "1" ]]; then
-    GUI_PORT="${HH_SBX_GUI_PORT:-6080}"
-    GUI_PASS="${HH_SBX_GUI_PASS:-hackhouse}"
-    # XFCE (minimal) + a terminal, the X session glue, a VNC server, and the
-    # noVNC web client + websockify bridge. All apt — works on Ubuntu/Debian/Kali.
-    # tigervnc-tools carries `vncpasswd`, which --no-install-recommends would
-    # otherwise drop (it ships only as a recommend of the standalone server) —
-    # without it the passwd write below is a silent no-op and VNC never auths.
-    apt-get install -y --no-install-recommends \
-        xfce4 xfce4-terminal dbus-x11 xfonts-base x11-xserver-utils \
-        tigervnc-standalone-server tigervnc-tools novnc websockify || true
-
-    export USER=root HOME=/root
-    # TigerVNC 1.15 (Kali/Debian trixie) reads its config from ~/.config/tigervnc
-    # and aborts with a fatal "Could not migrate /root/.vnc" if the legacy ~/.vnc
-    # exists, so write straight to the new path. /tmp/.X11-unix must exist + be
-    # sticky for the X socket; a fresh container may not have it.
-    VNCDIR=/root/.config/tigervnc
-    mkdir -p "$VNCDIR" /tmp/.X11-unix
-    chmod 1777 /tmp/.X11-unix 2>/dev/null || true
-    # Non-interactive VNC password (obfuscated, not strong auth — the real gate is
-    # the loopback-only publish + the room password). vncpasswd -f reads stdin.
-    printf '%s\n' "$GUI_PASS" | vncpasswd -f > "$VNCDIR/passwd" 2>/dev/null || true
-    chmod 600 "$VNCDIR/passwd" 2>/dev/null || true
-    cat > "$VNCDIR/xstartup" <<'XS'
-#!/bin/sh
-unset SESSION_MANAGER DBUS_SESSION_BUS_ADDRESS
-exec dbus-launch startxfce4
-XS
-    chmod +x "$VNCDIR/xstartup"
-
-    # Start the VNC server on display :1 (TCP 5901). -localhost no lets websockify
-    # (running in the same netns) reach it; nothing outside the container can —
-    # only $GUI_PORT is published, and only to host loopback.
-    if command -v vncserver >/dev/null 2>&1; then
-        vncserver -kill :1 >/dev/null 2>&1 || true
-        rm -f /tmp/.X1-lock /tmp/.X11-unix/X1 2>/dev/null || true
-        vncserver :1 -geometry 1280x800 -depth 24 -localhost no >/dev/null 2>&1 || true
-    fi
-    # noVNC web client → websocket → local VNC. Daemonize (nohup, detached stdio)
-    # so it outlives this `exec bash -s` provision session and keeps serving for
-    # the life of the container (PID 1 is `sleep infinity`).
-    if command -v websockify >/dev/null 2>&1; then
-        NOVNC_WEB=/usr/share/novnc
-        [[ -d "$NOVNC_WEB" ]] || NOVNC_WEB=/usr/share/webapps/novnc
-        nohup websockify --web="$NOVNC_WEB" "$GUI_PORT" localhost:5901 \
-            >/var/log/hh-novnc.log 2>&1 &
-    fi
-fi
-
 # ---- Goose harness (the /ai agent's sandbox `!task` path) --------------------
 # Goose ships as a release binary (not apt), so install it via its official
 # installer into a system path so every container user can run it. Best-effort: